Service manifest

Every service must have a service_manifest.yml file in its root directory. The manifest file presents essential information about the service to the Assemblyline core system, information the Assemblyline core system must have before it can run the service.

The table below shows all the elements that the manifest file can contain, including a brief description of each.

Field name	Value type	Required?	Description
accepts	Keyword	No Default: .*	Regexes applied to Assemblyline style file type string. For example, .* will allow the service to accept all types of files.
category	Keyword	No Default: Static Analysis	Which category is the service part of? Must be one of Antivirus, Dynamic Analysis, External, Extraction, Filtering, Internet Connected, Networking, or Static Analysis.
config	Mapping of Any	No	Dictionary of service configuration variables. The key names can be any Keyword and the value can be of Any type.
default_result_classification	Classification string	No Default: UNRESTRICTED	The default classification for the results generated by the service. If no classification is provided for a result section, this default classification is used.
dependencies	Mapping of Dependency Config	No	Refer to the dependency config section.
description	Text	No Default: NA	Detailed description of the service and its features.
disable_cache	Boolean	No Default: false	Should the result cache be disabled for this service? Only disable caching for services that will always provide different results each run.
docker_config	Docker Config	Yes	Refer to the Docker Config section.
enabled	Boolean	No Default: false	Should the service be enabled by default?
file_required	Boolean		Does the service require access to the file to perform its task? If set to false, the service will only have access to the file metadata (e.g. hashes, size, type, etc.).
heuristics	List of Heuristic	No	List of heuristic(s) used in the service for scoring. Refer to the heuristic section.
is_external	Boolean	No Default: false	Does the service make API calls to other products not part of the Assemblyline infrastructure (e.g. VirusTotal, ...)?
licence_count	Integer	No Default: 0	Number of concurrent services allowed to run at the same time.
name	Keyword	Yes	Name of the service.
privileged	Boolean	No Default: false	Allow service to have direct access to core for processing. Note: Should only be enabled on services that perform static analysis.
rejects	Keyword	No Default: empty|metadata/.*	Regexes applied to Assemblyline style file type string. For example, empty|metadata/.* will reject all empty and metadata files.
stage	Keyword	No Default: CORE	At which stage should the service run. Must be one of: (1) FILTER, (2) EXTRACT, (3) CORE, (4) SECONDARY, (5) POST, (6) REVIEW. Note that stages are executed in the numbered order shown.
submission_params	List of Submission Params	No	List of submission param(s) that define parameters that the user can change about the service for each of its scans. Refer to the submission_params section.
timeout	Integer	No Default: 60	Maximum execution time the service has before the task is timed out.
update_config	Update Config	No	Refer to the update config section.
version1	Keyword	Yes	Version of the service.

¹ the version in the manifest must be the same as the image tag in order to successfully pass registration on service update/load.

Dependency config

Field name	Value type	Required?	Description
container	Docker Config	Yes	Refer to Docker Config section.
volumes	Mapping of Persistent Volume	No	Refer to the persistent volume section.

Docker config

Field name	Value type	Required?	Description
allow_internet_access	Boolean	No Default: false	Should the container be allowed to access the internet?
command	List[Keyword]	No	Command that should be run when the container launches.
cpu_cores	Float	No Default: 1.0	Amount of CPU that should be allocated to the container.
environment	List of Environment Variable	No	Refer to the environment variable section.
image	Keyword	Yes	Image name always prepended by ${REGISTRY} or ${PRIVATE_REGISTRY} if image not on DockerHub. Append the rest of the image path. Do not put a / between the rest of the image path and registry var. Image name always ends in :$SERVICE_TAG
ports	List[Keyword]	No	List of ports to bind from the container.
ram_mb	Integer	No Default: 1024	Amount of RAM in MB that should be allocated to the container.

Environment variable

Field name	Value type	Required?	Description
name	Keyword	Yes	Name of the variable.
value	Keyword	Yes	Value of the variable.

Heuristic

Field name	Value type	Required?	Description
attack_id	Enum	No	Mitre's Att&ck matrix ID.
classification	Classification	No Default: UNRESTRICTED
description	Text	Yes	Detailed description of the heuristic which addresses the technique used to score.
filetype	Keyword	Yes	Regex of the filetype which applies to this heuristic.
heur_id	Keyword	Yes	Unique ID for identifying the heuristic.
max_score	Integer	No	The maximum score the heuristic can have.
name	Keyword	Yes	Short name for the heuristic.
score	Integer	Yes	Score that should be applied when this heuristic is set.

Persistent volume

Field name	Value type	Required?	Description
mount_path	Keyword	Yes	Path into the container to mount volume.
capacity	Keyword	Yes	Storage capacity required in bytes.
storage_class	Keyword	Yes

Submission params

Field name	Value type	Required?	Description
default	Any	Yes	Default value of the parameter.
name	Keyword	Yes	Variable name of the parameter.
type	Enum	Yes	Type of variable. Must be one of: bool, int, list, or str.
value	Any	Yes	Value of the variable as configured by the user or the default if not configured.

Update config

Field name	Value type	Required?	Description
generates_signatures	Boolean	No Default: false	Should the downloaded files be used to create signatures in the system?
sources	List of Update Source	No	List of source(s) from which updates can be downloaded. Refer to the update source section.
update_interval_seconds	Integer	Yes	Interval in seconds at which the updater runs.
wait_for_update	Boolean	False	Should the service wait for its updater dependency to be running?
signature_delimiter	Enum	Must be of: new_line, double_new_line, pipe, comma, space, none, file, custom	Type of delimiter used for signaure downloads.
custom_delimiter	Keyword	Optional	Custom signature delimiter to use when signature_delimiter: custom

Update source

Field name	Value type	Required?	Description
headers	List of Environment Variable	No	Refer to the environment variable section.
name	Keyword	Yes	Unique name of the source.
password	Keyword	No	The password required to access the file.
pattern	Keyword	No	Regex pattern to match against the file names of all downloaded files from this source. This is useful when you want to filter out some files from a repo which contains many files.
private_key	Keyword	No	Key for accessing file or Git repo.
uri	Keyword	Yes	URL of the update file. Some example URL formats are: git@github.com:sample/sample-repo.git, https://file-examples.com/wp-content/uploads/2017/02/zip_2MB.zip.
username	Keyword	No	The username required to access the file.